[ { "Id": "128f4c8313a3f95a53e9706585c27f258124e993f7f6992db1b8fd0304297a6c", "Created": "2026-08-15T21:55:47.539273207+03:00", "Path": "/usr/bin/tini", "Args": [ "--", "/bin/sh", "-c", "[ -n \"${HOME-}\" ] || { echo 'agent_cred: HOME unset in container' >&2; exit 10; }\nagent_cred_target=\"${HOME%/}/.codex/auth.json\"\ntrap 'rm -f \"$agent_cred_target\"' EXIT HUP INT TERM\nmkdir -p \"${agent_cred_target%/*}\" || { echo 'agent_cred: cannot create credential directory' >&2; exit 10; }\n[ -r '/sandbox-secrets/codex/auth.json' ] || { echo 'agent_cred: staging mount missing: /sandbox-secrets/codex/auth.json' >&2; exit 10; }\ncp '/sandbox-secrets/codex/auth.json' \"$agent_cred_target\" || { echo 'agent_cred: credential copy failed' >&2; exit 10; }\nchmod 600 \"$agent_cred_target\" || { echo 'agent_cred: cannot restrict credential mode' >&2; exit 10; }\n\"$@\"", "sh", "codex", "exec", "--sandbox", "danger-full-access", "--skip-git-repo-check", "-m", "gpt-5.6-sol", "-c", "model_reasoning_effort=high", "You are hardening the codex offload path in the overdeck repo (/home/user/Projects/overdeck). Owner-approved security work; implement, test, and land both fixes. This is real, land it — do not just propose.\n\nWORKFLOW: work in a fresh worktree via `~/.claude/bin/od-worktree add codex-seat-harden` then cd /home/user/Projects/overdeck/.worktrees/codex-seat-harden. NEVER edit the shared main checkout directly. Read the audit report first: docs/plans/2026-08-16-codex-seat-audit.md (on origin/main or branch wt/codex-seat-audit) — it has exact file paths and evidence for both findings. Also read the repo CLAUDE.md 'Landing' section for how to land.\n\nFIX 1 — SEAT CONTAINER EGRESS default-deny + allowlist. The podman seat containers (launched via the cdx.py -> remote_dispatch.py chain and/or deck-podman / seat-run.sh — the audit names the exact spot) currently allow unrestricted outbound network. Make egress default-DENY with an allowlist for package registries and git, as a single source-of-truth config (not scattered literals): registry.npmjs.org; crates.io, static.crates.io, index.crates.io; pypi.org, files.pythonhosted.org; deb.debian.org, security.debian.org; github.com, codeload.github.com, objects.githubusercontent.com; plus the buildbox tailscale mirror hosts derived from ~/.claude/buildbox-hosts.json (NEVER hardcode host IPs — read them). Prefer podman-native egress control surviving restart; a minimal proxy/firewall sidecar is acceptable if needed. FAIL CLOSED: allowlist unreachable/misconfigured -> deny, never fall open to unrestricted. Any per-task 'needs more network' escape must be explicit and logged, never the default.\n\nFIX 2 — SECRET-FILE FILTER at dispatch. The snapshot shipped to the box trusts each project's .gitignore; shared boxes serve other projects (press-zone, wp-content, multideal) that may not maintain it. Add a dispatch-layer denylist in the snapshot/push path (remote_dispatch.py) that excludes, regardless of gitignore: .env and .env.*; *.pem *.key *.p12 *.pfx; id_rsa* id_ed25519* and other private keys; .secrets/**; *.secret; .npmrc/.pypirc containing auth; aws/gcp/ssh credential files. Do NOT exclude the legitimate seat credential file modules/harness/seat/credentials.json (audit flagged this false-positive risk — allowlist that exact path). FAIL LOUD: when a secret-shaped file is excluded, log which pattern matched (never silently drop, never ship it).\n\nCONSTRAINTS: both changes gate every offload — MUST be fail-closed and TESTED both branches. Add tests in modules/systray/tests/ (dispatch/secret-filter: planted .env excluded+logged, credentials.json still ships, normal file ships) and wherever the container-network config tests live (allowed host passes, denied host blocked). modules/systray/tests has 2 known pre-existing unrelated failures (account_lock umask, packaging_desktop_entry drift) — leave them, name them. Run: python3 -m pytest modules/systray/tests/ -q. TWO container systems exist per the audit — fix the cdx-exec podman path FIRST (what the owner offloads through); if the second shares the network/snapshot code fix once, else NAME it as a follow-up in the plan doc, do not rework it this slice.\n\nVERIFY before landing: FIX 2 — run the exclude logic against a fixture dir with a planted .env + a normal file + a credentials.json, assert .env excluded+logged, other two ship. FIX 1 — syntactically apply the egress config; a live allowed-ok/denied-blocked probe is best-effort, name it Not-verified if you cannot run it.\n\nLAND: commit both fixes on branch wt/codex-seat-harden (terse messages), then land per the repo CLAUDE.md. Use the DIRECT LAND escape hatch (it is in CLAUDE.md: /usr/bin/git -C -c core.hooksPath= push origin HEAD:refs/heads/main after re-fetching+merging origin/main, then cd repo root and bash packaging/deploy-local.sh) BECAUSE this is critical security work and the land queue is 75 deep. You own verification since direct-land skips the gate: run the systray tests yourself and report what you did NOT verify. Update docs/plans/2026-08-16-codex-seat-audit.md marking the two CRITICALs FIXED with the commit shas.\n\nREPORT at the end: per-fix what changed + file paths, allowlist config location, secret-filter test output, egress probe result or why not run, the second-system decision, the landed commit sha on origin/main, and a Not-verified list." ], "State": { "OciVersion": "1.2.1", "Status": "running", "Running": true, "Paused": false, "Restarting": false, "OOMKilled": false, "Dead": false, "Pid": 232660, "ConmonPid": 232657, "ExitCode": 0, "Error": "", "StartedAt": "2026-08-15T21:55:47.691984936+03:00", "FinishedAt": "0001-01-01T00:00:00Z", "CgroupPath": "/user.slice/user-1000.slice/user@1000.service/user.slice/libpod-128f4c8313a3f95a53e9706585c27f258124e993f7f6992db1b8fd0304297a6c.scope", "CheckpointedAt": "0001-01-01T00:00:00Z", "RestoredAt": "0001-01-01T00:00:00Z" }, "Image": "a7eb5250818c802b103779019e19d4ada20a636aef9054930ec30016516b9aaf", "ImageDigest": "sha256:05abf7962fb582174c8c33f712fb82c38951ccac266621d7b40e652b67d81097", "ImageName": "localhost/overdeck-agent-sandbox:d1c7f17660b1", "Rootfs": "", "Pod": "", "ResolvConfPath": "/run/user/1000/containers/overlay-containers/128f4c8313a3f95a53e9706585c27f258124e993f7f6992db1b8fd0304297a6c/userdata/resolv.conf", "HostnamePath": "/run/user/1000/containers/overlay-containers/128f4c8313a3f95a53e9706585c27f258124e993f7f6992db1b8fd0304297a6c/userdata/hostname", "HostsPath": "/run/user/1000/containers/overlay-containers/128f4c8313a3f95a53e9706585c27f258124e993f7f6992db1b8fd0304297a6c/userdata/hosts", "StaticDir": "/home/user/.local/share/containers/storage/overlay-containers/128f4c8313a3f95a53e9706585c27f258124e993f7f6992db1b8fd0304297a6c/userdata", "OCIConfigPath": "/home/user/.local/share/containers/storage/overlay-containers/128f4c8313a3f95a53e9706585c27f258124e993f7f6992db1b8fd0304297a6c/userdata/config.json", "OCIRuntime": "crun", "ConmonPidFile": "/run/user/1000/containers/overlay-containers/128f4c8313a3f95a53e9706585c27f258124e993f7f6992db1b8fd0304297a6c/userdata/conmon.pid", "PidFile": "/run/user/1000/containers/overlay-containers/128f4c8313a3f95a53e9706585c27f258124e993f7f6992db1b8fd0304297a6c/userdata/pidfile", "Name": "overdeck-sandbox-ledger-announce-once-b26917d3f2ae", "RestartCount": 0, "Driver": "overlay", "MountLabel": "", "ProcessLabel": "", "AppArmorProfile": "", "EffectiveCaps": null, "BoundingCaps": null, "ExecIDs": [], "GraphDriver": { "Name": "overlay", "Data": { "LowerDir": "/home/user/.local/share/containers/storage/overlay/3e8801912cbeb9ee125d408c661688b63aa79edff23bb1d465e0592cd7aee30e/diff:/home/user/.local/share/containers/storage/overlay/fa6614715059bf58e1ff8042c3ceac8c70948a9fdfebbca3f10e99cb426c9116/diff:/home/user/.local/share/containers/storage/overlay/e1440254663234040539164f7031e3e60276ea61c8128a827269453309a19b08/diff:/home/user/.local/share/containers/storage/overlay/66dcc187f20c9adfa3e3d9076e59f32b9fee63ddc435137e2ed586dce5ad0b0a/diff:/home/user/.local/share/containers/storage/overlay/e54fd5490a1c3dc0ddfcc9b31e08dca344fa2211e9ef34dae4788878a3ab069b/diff:/home/user/.local/share/containers/storage/overlay/291c74a8d55109cf4a6ca696cbdc6affc42e1de28dde5422ae494fb8abd87195/diff:/home/user/.local/share/containers/storage/overlay/aada397d822a1a53d2824a0c53a996d4159e8b7aade3d4ce28397f77feadb6e0/diff:/home/user/.local/share/containers/storage/overlay/e4b696f23f3708113e735eae64e9b39c39250decdbee572c781e6e817d6e53fb/diff:/home/user/.local/share/containers/storage/overlay/94f8cd5e058475b44b2454e8efb618afdb9f213c8b17d737aecd4d8f68f4f103/diff:/home/user/.local/share/containers/storage/overlay/b5f84eefc76473ba4d51f4aac92c04dc9ab54ffef84ca96d737e8d6e7dfc923f/diff:/home/user/.local/share/containers/storage/overlay/89fa520c6803c2724c744bf1ef5ce0f6b61121cff78c107ed751055f880c6bde/diff:/home/user/.local/share/containers/storage/overlay/8bba409efaa55e20fd14dab87cd1d2fc6c02f0eddd668a8731251e16a87b0842/diff:/home/user/.local/share/containers/storage/overlay/1c9774c7f21648d1e3974dbed4f761882063e0c59b45565ea0a20ee1e79c3015/diff:/home/user/.local/share/containers/storage/overlay/7de836d8555b12af133986347e4d0d5ad97230067302caa638ce6c01cb807330/diff:/home/user/.local/share/containers/storage/overlay/33abc4ad76e2099a56041549ac0643312ed831660ea7f28e07f05bc228e12f78/diff", "MergedDir": "/home/user/.local/share/containers/storage/overlay/aec952446c14fc2507581f561ea2f5786fe8153800b4675e59d6547bfc30bca5/merged", "UpperDir": "/home/user/.local/share/containers/storage/overlay/aec952446c14fc2507581f561ea2f5786fe8153800b4675e59d6547bfc30bca5/diff", "WorkDir": "/home/user/.local/share/containers/storage/overlay/aec952446c14fc2507581f561ea2f5786fe8153800b4675e59d6547bfc30bca5/work" } }, "Mounts": [ { "Type": "bind", "Source": "/home/user/sandbox", "Destination": "/sandbox", "Driver": "", "Mode": "", "Options": [ "rbind" ], "RW": true, "Propagation": "rprivate" }, { "Type": "bind", "Source": "/home/user/.local/share/overdeck-sandbox/secrets/e2e_key", "Destination": "/sandbox-secrets/e2e_key", "Driver": "", "Mode": "", "Options": [ "rbind" ], "RW": false, "Propagation": "rprivate" }, { "Type": "bind", "Source": "/home/user/.local/share/overdeck-sandbox/secrets/e2e_known_hosts", "Destination": "/sandbox-secrets/e2e_known_hosts", "Driver": "", "Mode": "", "Options": [ "rbind" ], "RW": false, "Propagation": "rprivate" }, { "Type": "bind", "Source": "/var/lib/buildbox/cdx-offload/repos/overdeck-73dd7c243420.git", "Destination": "/home/user/cdx-offload/repos/overdeck-73dd7c243420.git", "Driver": "", "Mode": "", "Options": [ "rbind" ], "RW": true, "Propagation": "rprivate" }, { "Type": "bind", "Source": "/home/user/.local/state/overdeck-sandbox/creds/1786820137709579538-3480870-1310/codex/auth.json", "Destination": "/sandbox-secrets/codex/auth.json", "Driver": "", "Mode": "", "Options": [ "rbind" ], "RW": false, "Propagation": "rprivate" } ], "Dependencies": [], "NetworkSettings": { "EndpointID": "", "Gateway": "", "IPAddress": "", "IPPrefixLen": 0, "IPv6Gateway": "", "GlobalIPv6Address": "", "GlobalIPv6PrefixLen": 0, "MacAddress": "", "Bridge": "", "SandboxID": "", "HairpinMode": false, "LinkLocalIPv6Address": "", "LinkLocalIPv6PrefixLen": 0, "Ports": {}, "SandboxKey": "/run/user/1000/netns/netns-3a6ba265-1d47-a5b0-6018-75f381d51e46" }, "Namespace": "", "IsInfra": false, "IsService": false, "KubeExitCodePropagation": "invalid", "lockNumber": 0, "Config": { "Hostname": "sandbox-ledger-announce-once-b26917d3f2ae", "Domainname": "", "User": "agent", "AttachStdin": false, "AttachStdout": false, "AttachStderr": false, "Tty": false, "OpenStdin": true, "StdinOnce": false, "Env": [ "PATH=/usr/local/node/bin:/sandbox/home/.local/share/pnpm:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "HOME=/sandbox/home", "PNPM_HOME=/sandbox/home/.local/share/pnpm", "PNPM_STORE_DIR=/sandbox/store/pnpm", "LANG=C.UTF-8", "SANDBOX_E2E_PORT=2222", "SANDBOX_IMAGE=localhost/overdeck-agent-sandbox:d1c7f17660b1", "PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1", "SANDBOX_TOOLGAP_FILE=/sandbox/toolgap/gaps.jsonl", "SANDBOX_E2E_TARGET=user@host.containers.internal", "SANDBOX_ID=ledger-announce-once-b26917d3f2ae", "container=podman", "BASH_ENV=/etc/overdeck-sandbox/toolgap.bash", "COREPACK_ENABLE_DOWNLOAD_PROMPT=0", "DISABLE_AUTOUPDATER=1", "DEBIAN_FRONTEND=noninteractive", "PLAYWRIGHT_BROWSERS_PATH=/ms-playwright", "HOSTNAME=sandbox-ledger-announce-once-b26917d3f2ae" ], "Cmd": [ "/bin/sh", "-c", "[ -n \"${HOME-}\" ] || { echo 'agent_cred: HOME unset in container' \u003e\u00262; exit 10; }\nagent_cred_target=\"${HOME%/}/.codex/auth.json\"\ntrap 'rm -f \"$agent_cred_target\"' EXIT HUP INT TERM\nmkdir -p \"${agent_cred_target%/*}\" || { echo 'agent_cred: cannot create credential directory' \u003e\u00262; exit 10; }\n[ -r '/sandbox-secrets/codex/auth.json' ] || { echo 'agent_cred: staging mount missing: /sandbox-secrets/codex/auth.json' \u003e\u00262; exit 10; }\ncp '/sandbox-secrets/codex/auth.json' \"$agent_cred_target\" || { echo 'agent_cred: credential copy failed' \u003e\u00262; exit 10; }\nchmod 600 \"$agent_cred_target\" || { echo 'agent_cred: cannot restrict credential mode' \u003e\u00262; exit 10; }\n\"$@\"", "sh", "codex", "exec", "--sandbox", "danger-full-access", "--skip-git-repo-check", "-m", "gpt-5.6-sol", "-c", "model_reasoning_effort=high", "You are hardening the codex offload path in the overdeck repo (/home/user/Projects/overdeck). Owner-approved security work; implement, test, and land both fixes. This is real, land it — do not just propose.\n\nWORKFLOW: work in a fresh worktree via `~/.claude/bin/od-worktree add codex-seat-harden` then cd /home/user/Projects/overdeck/.worktrees/codex-seat-harden. NEVER edit the shared main checkout directly. Read the audit report first: docs/plans/2026-08-16-codex-seat-audit.md (on origin/main or branch wt/codex-seat-audit) — it has exact file paths and evidence for both findings. Also read the repo CLAUDE.md 'Landing' section for how to land.\n\nFIX 1 — SEAT CONTAINER EGRESS default-deny + allowlist. The podman seat containers (launched via the cdx.py -\u003e remote_dispatch.py chain and/or deck-podman / seat-run.sh — the audit names the exact spot) currently allow unrestricted outbound network. Make egress default-DENY with an allowlist for package registries and git, as a single source-of-truth config (not scattered literals): registry.npmjs.org; crates.io, static.crates.io, index.crates.io; pypi.org, files.pythonhosted.org; deb.debian.org, security.debian.org; github.com, codeload.github.com, objects.githubusercontent.com; plus the buildbox tailscale mirror hosts derived from ~/.claude/buildbox-hosts.json (NEVER hardcode host IPs — read them). Prefer podman-native egress control surviving restart; a minimal proxy/firewall sidecar is acceptable if needed. FAIL CLOSED: allowlist unreachable/misconfigured -\u003e deny, never fall open to unrestricted. Any per-task 'needs more network' escape must be explicit and logged, never the default.\n\nFIX 2 — SECRET-FILE FILTER at dispatch. The snapshot shipped to the box trusts each project's .gitignore; shared boxes serve other projects (press-zone, wp-content, multideal) that may not maintain it. Add a dispatch-layer denylist in the snapshot/push path (remote_dispatch.py) that excludes, regardless of gitignore: .env and .env.*; *.pem *.key *.p12 *.pfx; id_rsa* id_ed25519* and other private keys; .secrets/**; *.secret; .npmrc/.pypirc containing auth; aws/gcp/ssh credential files. Do NOT exclude the legitimate seat credential file modules/harness/seat/credentials.json (audit flagged this false-positive risk — allowlist that exact path). FAIL LOUD: when a secret-shaped file is excluded, log which pattern matched (never silently drop, never ship it).\n\nCONSTRAINTS: both changes gate every offload — MUST be fail-closed and TESTED both branches. Add tests in modules/systray/tests/ (dispatch/secret-filter: planted .env excluded+logged, credentials.json still ships, normal file ships) and wherever the container-network config tests live (allowed host passes, denied host blocked). modules/systray/tests has 2 known pre-existing unrelated failures (account_lock umask, packaging_desktop_entry drift) — leave them, name them. Run: python3 -m pytest modules/systray/tests/ -q. TWO container systems exist per the audit — fix the cdx-exec podman path FIRST (what the owner offloads through); if the second shares the network/snapshot code fix once, else NAME it as a follow-up in the plan doc, do not rework it this slice.\n\nVERIFY before landing: FIX 2 — run the exclude logic against a fixture dir with a planted .env + a normal file + a credentials.json, assert .env excluded+logged, other two ship. FIX 1 — syntactically apply the egress config; a live allowed-ok/denied-blocked probe is best-effort, name it Not-verified if you cannot run it.\n\nLAND: commit both fixes on branch wt/codex-seat-harden (terse messages), then land per the repo CLAUDE.md. Use the DIRECT LAND escape hatch (it is in CLAUDE.md: /usr/bin/git -C \u003cworktree\u003e -c core.hooksPath=\u003cempty-dir\u003e push origin HEAD:refs/heads/main after re-fetching+merging origin/main, then cd repo root and bash packaging/deploy-local.sh) BECAUSE this is critical security work and the land queue is 75 deep. You own verification since direct-land skips the gate: run the systray tests yourself and report what you did NOT verify. Update docs/plans/2026-08-16-codex-seat-audit.md marking the two CRITICALs FIXED with the commit shas.\n\nREPORT at the end: per-fix what changed + file paths, allowlist config location, secret-filter test output, egress probe result or why not run, the second-system decision, the landed commit sha on origin/main, and a Not-verified list." ], "Image": "localhost/overdeck-agent-sandbox:d1c7f17660b1", "Volumes": null, "WorkingDir": "/sandbox/workspaces/ledger-announce-once-b26917d3f2ae", "Entrypoint": [ "/usr/bin/tini", "--" ], "OnBuild": null, "Labels": { "io.buildah.version": "1.43.2" }, "Annotations": { "io.container.manager": "libpod", "io.podman.annotations.cid-file": "/home/user/.local/share/overdeck-sandbox/runs/ledger-announce-once-b26917d3f2ae/cid", "io.podman.annotations.pids-limit": "512", "io.podman.annotations.userns": "keep-id", "org.opencontainers.image.stopSignal": "15", "org.systemd.property.KillSignal": "15", "org.systemd.property.TimeoutStopUSec": "uint64 10000000" }, "StopSignal": "SIGTERM", "HealthcheckOnFailureAction": "none", "HealthLogDestination": "local", "HealthcheckMaxLogCount": 5, "HealthcheckMaxLogSize": 500, "CreateCommand": [ "podman", "run", "--replace", "--interactive", "--cidfile", "/home/user/.local/share/overdeck-sandbox/runs/ledger-announce-once-b26917d3f2ae/cid", "--name", "overdeck-sandbox-ledger-announce-once-b26917d3f2ae", "--hostname", "sandbox-ledger-announce-once-b26917d3f2ae", "--userns=keep-id", "--cap-drop=ALL", "--security-opt=no-new-privileges", "--pids-limit", "512", "--memory", "12g", "--memory-swap", "12g", "--cpus", "4", "--cpu-shares", "256", "--volume", "/home/user/sandbox:/sandbox:rw", "--volume", "/home/user/.local/share/overdeck-sandbox/secrets/e2e_key:/sandbox-secrets/e2e_key:ro", "--volume", "/home/user/.local/share/overdeck-sandbox/secrets/e2e_known_hosts:/sandbox-secrets/e2e_known_hosts:ro", "--volume", "/var/lib/buildbox/cdx-offload/repos/overdeck-73dd7c243420.git:/home/user/cdx-offload/repos/overdeck-73dd7c243420.git:rw", "--volume", "/home/user/.local/state/overdeck-sandbox/creds/1786820137709579538-3480870-1310/codex/auth.json:/sandbox-secrets/codex/auth.json:ro", "--workdir", "/sandbox/workspaces/ledger-announce-once-b26917d3f2ae", "--env", "SANDBOX_ID=ledger-announce-once-b26917d3f2ae", "--env", "SANDBOX_IMAGE=localhost/overdeck-agent-sandbox:d1c7f17660b1", "--env", "SANDBOX_E2E_TARGET=user@host.containers.internal", "--env", "SANDBOX_E2E_PORT=2222", "localhost/overdeck-agent-sandbox:d1c7f17660b1", "/bin/sh", "-c", "[ -n \"${HOME-}\" ] || { echo 'agent_cred: HOME unset in container' \u003e\u00262; exit 10; }\nagent_cred_target=\"${HOME%/}/.codex/auth.json\"\ntrap 'rm -f \"$agent_cred_target\"' EXIT HUP INT TERM\nmkdir -p \"${agent_cred_target%/*}\" || { echo 'agent_cred: cannot create credential directory' \u003e\u00262; exit 10; }\n[ -r '/sandbox-secrets/codex/auth.json' ] || { echo 'agent_cred: staging mount missing: /sandbox-secrets/codex/auth.json' \u003e\u00262; exit 10; }\ncp '/sandbox-secrets/codex/auth.json' \"$agent_cred_target\" || { echo 'agent_cred: credential copy failed' \u003e\u00262; exit 10; }\nchmod 600 \"$agent_cred_target\" || { echo 'agent_cred: cannot restrict credential mode' \u003e\u00262; exit 10; }\n\"$@\"", "sh", "codex", "exec", "--sandbox", "danger-full-access", "--skip-git-repo-check", "-m", "gpt-5.6-sol", "-c", "model_reasoning_effort=high", "You are hardening the codex offload path in the overdeck repo (/home/user/Projects/overdeck). Owner-approved security work; implement, test, and land both fixes. This is real, land it — do not just propose.\n\nWORKFLOW: work in a fresh worktree via `~/.claude/bin/od-worktree add codex-seat-harden` then cd /home/user/Projects/overdeck/.worktrees/codex-seat-harden. NEVER edit the shared main checkout directly. Read the audit report first: docs/plans/2026-08-16-codex-seat-audit.md (on origin/main or branch wt/codex-seat-audit) — it has exact file paths and evidence for both findings. Also read the repo CLAUDE.md 'Landing' section for how to land.\n\nFIX 1 — SEAT CONTAINER EGRESS default-deny + allowlist. The podman seat containers (launched via the cdx.py -\u003e remote_dispatch.py chain and/or deck-podman / seat-run.sh — the audit names the exact spot) currently allow unrestricted outbound network. Make egress default-DENY with an allowlist for package registries and git, as a single source-of-truth config (not scattered literals): registry.npmjs.org; crates.io, static.crates.io, index.crates.io; pypi.org, files.pythonhosted.org; deb.debian.org, security.debian.org; github.com, codeload.github.com, objects.githubusercontent.com; plus the buildbox tailscale mirror hosts derived from ~/.claude/buildbox-hosts.json (NEVER hardcode host IPs — read them). Prefer podman-native egress control surviving restart; a minimal proxy/firewall sidecar is acceptable if needed. FAIL CLOSED: allowlist unreachable/misconfigured -\u003e deny, never fall open to unrestricted. Any per-task 'needs more network' escape must be explicit and logged, never the default.\n\nFIX 2 — SECRET-FILE FILTER at dispatch. The snapshot shipped to the box trusts each project's .gitignore; shared boxes serve other projects (press-zone, wp-content, multideal) that may not maintain it. Add a dispatch-layer denylist in the snapshot/push path (remote_dispatch.py) that excludes, regardless of gitignore: .env and .env.*; *.pem *.key *.p12 *.pfx; id_rsa* id_ed25519* and other private keys; .secrets/**; *.secret; .npmrc/.pypirc containing auth; aws/gcp/ssh credential files. Do NOT exclude the legitimate seat credential file modules/harness/seat/credentials.json (audit flagged this false-positive risk — allowlist that exact path). FAIL LOUD: when a secret-shaped file is excluded, log which pattern matched (never silently drop, never ship it).\n\nCONSTRAINTS: both changes gate every offload — MUST be fail-closed and TESTED both branches. Add tests in modules/systray/tests/ (dispatch/secret-filter: planted .env excluded+logged, credentials.json still ships, normal file ships) and wherever the container-network config tests live (allowed host passes, denied host blocked). modules/systray/tests has 2 known pre-existing unrelated failures (account_lock umask, packaging_desktop_entry drift) — leave them, name them. Run: python3 -m pytest modules/systray/tests/ -q. TWO container systems exist per the audit — fix the cdx-exec podman path FIRST (what the owner offloads through); if the second shares the network/snapshot code fix once, else NAME it as a follow-up in the plan doc, do not rework it this slice.\n\nVERIFY before landing: FIX 2 — run the exclude logic against a fixture dir with a planted .env + a normal file + a credentials.json, assert .env excluded+logged, other two ship. FIX 1 — syntactically apply the egress config; a live allowed-ok/denied-blocked probe is best-effort, name it Not-verified if you cannot run it.\n\nLAND: commit both fixes on branch wt/codex-seat-harden (terse messages), then land per the repo CLAUDE.md. Use the DIRECT LAND escape hatch (it is in CLAUDE.md: /usr/bin/git -C \u003cworktree\u003e -c core.hooksPath=\u003cempty-dir\u003e push origin HEAD:refs/heads/main after re-fetching+merging origin/main, then cd repo root and bash packaging/deploy-local.sh) BECAUSE this is critical security work and the land queue is 75 deep. You own verification since direct-land skips the gate: run the systray tests yourself and report what you did NOT verify. Update docs/plans/2026-08-16-codex-seat-audit.md marking the two CRITICALs FIXED with the commit shas.\n\nREPORT at the end: per-fix what changed + file paths, allowlist config location, secret-filter test output, egress probe result or why not run, the second-system decision, the landed commit sha on origin/main, and a Not-verified list." ], "Umask": "0022", "Timeout": 0, "StopTimeout": 10, "Passwd": true, "sdNotifyMode": "container" }, "HostConfig": { "Binds": [ "/home/user/sandbox:/sandbox:rw,rprivate,rbind", "/home/user/.local/share/overdeck-sandbox/secrets/e2e_key:/sandbox-secrets/e2e_key:ro,rprivate,rbind", "/home/user/.local/share/overdeck-sandbox/secrets/e2e_known_hosts:/sandbox-secrets/e2e_known_hosts:ro,rprivate,rbind", "/var/lib/buildbox/cdx-offload/repos/overdeck-73dd7c243420.git:/home/user/cdx-offload/repos/overdeck-73dd7c243420.git:rw,rprivate,rbind", "/home/user/.local/state/overdeck-sandbox/creds/1786820137709579538-3480870-1310/codex/auth.json:/sandbox-secrets/codex/auth.json:ro,rprivate,rbind" ], "CgroupManager": "systemd", "CgroupMode": "private", "ContainerIDFile": "/home/user/.local/share/overdeck-sandbox/runs/ledger-announce-once-b26917d3f2ae/cid", "LogConfig": { "Type": "journald", "Config": null, "Path": "", "Tag": "", "Size": "-1B" }, "NetworkMode": "pasta", "PortBindings": {}, "RestartPolicy": { "Name": "no", "MaximumRetryCount": 0 }, "AutoRemove": false, "AutoRemoveImage": false, "Annotations": { "io.container.manager": "libpod", "io.podman.annotations.cid-file": "/home/user/.local/share/overdeck-sandbox/runs/ledger-announce-once-b26917d3f2ae/cid", "io.podman.annotations.pids-limit": "512", "io.podman.annotations.userns": "keep-id", "org.opencontainers.image.stopSignal": "15", "org.systemd.property.KillSignal": "15", "org.systemd.property.TimeoutStopUSec": "uint64 10000000" }, "VolumeDriver": "", "VolumesFrom": null, "CapAdd": [], "CapDrop": [ "CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_FOWNER", "CAP_FSETID", "CAP_KILL", "CAP_NET_BIND_SERVICE", "CAP_SETFCAP", "CAP_SETGID", "CAP_SETPCAP", "CAP_SETUID", "CAP_SYS_CHROOT" ], "Dns": [], "DnsOptions": [], "DnsSearch": [], "ExtraHosts": [], "HostsFile": "", "GroupAdd": [], "IpcMode": "shareable", "Cgroup": "", "Cgroups": "default", "Links": null, "OomScoreAdj": 0, "PidMode": "private", "Privileged": false, "PublishAllPorts": false, "ReadonlyRootfs": false, "SecurityOpt": [ "no-new-privileges" ], "Tmpfs": {}, "UTSMode": "private", "UsernsMode": "private", "IDMappings": { "UidMap": [ "0:1:1000", "1000:0:1", "1001:1001:64536" ], "GidMap": [ "0:1:1000", "1000:0:1", "1001:1001:64536" ] }, "ShmSize": 65536000, "Runtime": "oci", "ConsoleSize": [ 0, 0 ], "Isolation": "", "CpuShares": 256, "Memory": 12884901888, "NanoCpus": 4000000000, "CgroupParent": "user.slice", "BlkioWeight": 0, "BlkioWeightDevice": null, "BlkioDeviceReadBps": null, "BlkioDeviceWriteBps": null, "BlkioDeviceReadIOps": null, "BlkioDeviceWriteIOps": null, "CpuPeriod": 100000, "CpuQuota": 400000, "CpuRealtimePeriod": 0, "CpuRealtimeRuntime": 0, "CpusetCpus": "", "CpusetMems": "", "Devices": [], "DiskQuota": 0, "KernelMemory": 0, "MemoryReservation": 0, "MemorySwap": 12884901888, "MemorySwappiness": -1, "OomKillDisable": false, "PidsLimit": 512, "Ulimits": [ { "Name": "RLIMIT_NOFILE", "Soft": 524288, "Hard": 524288 }, { "Name": "RLIMIT_NPROC", "Soft": 127162, "Hard": 127162 } ], "CpuCount": 0, "CpuPercent": 0, "IOMaximumIOps": 0, "IOMaximumBandwidth": 0, "CgroupConf": null }, "UseImageHosts": false, "UseImageHostname": false } ]